From e59320ad70f699d15a38d41ec35c1598b7831b79 Mon Sep 17 00:00:00 2001
From: Ammar Askar <ammar@ammaraskar.com>
Date: Tue, 2 Mar 2021 08:55:20 -0800
Subject: [PATCH] Add advisory for double-free in scratchpad

---
 crates/scratchpad/RUSTSEC-0000-0000.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 crates/scratchpad/RUSTSEC-0000-0000.md

diff --git a/crates/scratchpad/RUSTSEC-0000-0000.md b/crates/scratchpad/RUSTSEC-0000-0000.md
new file mode 100644
index 0000000..49ba625
--- /dev/null
+++ b/crates/scratchpad/RUSTSEC-0000-0000.md
@@ -0,0 +1,26 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "scratchpad"
+date = "2021-02-18"
+url = "https://github.com/okready/scratchpad/issues/1"
+categories = ["memory-corruption"]
+keywords = ["memory-safety", "double-free"]
+
+[versions]
+patched = [">= 1.3.1"]
+
+[affected]
+functions = { "scratchpad::SliceMoveSource::move_elements" = ["< 1.3.1"] }
+```
+
+# move_elements can double-free objects on panic
+
+Affected versions of `scratchpad` used `ptr::read` to read elements while
+calling a user provided function `f` on them.
+
+Since the pointer read duplicates ownership, a panic inside the user provided
+`f` function could cause a double free when unwinding.
+
+The flaw was fixed in commit `891561bea` by removing the unsafe block and using
+a plain iterator.